Описание
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
Helm is a package manager for Charts for Kubernetes. In Helm versions >=4.0.0 and <=4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required.
Impact
The bug allows plugin authors to omit provenance (signing) data from plugins, bypassing plugin signature verification upon plugin install/update.
Notably, plugin hooks will be executed as designed on the installed plugin, enabling a malicious plugin to execute arbitrary code.
Patches
This issue has been patched in Helm v4.1.4
Installing/updating a plugin with missing provenance will error if signature verification is required.
Workarounds
Users may manually validate that a plugin archive is not missing provenance data (.prov file) before installation.
Ссылки
Пакеты
helm.sh/helm/v4
>= 4.0.0, <= 4.1.3
4.1.4
Связанные уязвимости
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1 ...
Уязвимость пакетного менеджера для Kubernetes Helm, связанная с использованием незащищенного альтернативного канала, позволяющая нарушителю раскрыть защищаемую информацию